Generated on Tue, 6 Feb 2024 12:11:28

ZAP Version: 2.14.0

Summary of Alerts

Risk Level Number of Alerts
High
1
Medium
3
Low
4
Informational
8
False Positives:
0

Alerts

Name Risk Level Number of Instances
Cross Site Scripting (Reflected) High 1
Absence of Anti-CSRF Tokens Medium 8
Content Security Policy (CSP) Header Not Set Medium 75
Missing Anti-clickjacking Header Medium 73
Cookie No HttpOnly Flag Low 3
Cookie without SameSite Attribute Low 3
Strict-Transport-Security Header Not Set Low 28
X-Content-Type-Options Header Missing Low 93
Charset Mismatch (Header Versus Meta Content-Type Charset) Informational 12
Cookie Poisoning Informational 4
Information Disclosure - Suspicious Comments Informational 2
Modern Web Application Informational 19
Re-examine Cache-control Directives Informational 17
Retrieved from Cache Informational 3
Session Management Response Identified Informational 19
User Agent Fuzzer Informational 48

Passing Rules

Name Rule Type Threshold Strength
Directory Browsing Active MEDIUM MEDIUM
CRLF Injection Active MEDIUM MEDIUM
Path Traversal Active MEDIUM MEDIUM
Remote File Inclusion Active MEDIUM MEDIUM
Parameter Tampering Active MEDIUM MEDIUM
Server Side Include Active MEDIUM MEDIUM
GET for POST Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) Active MEDIUM MEDIUM
Script Active Scan Rules Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) - Prime Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) - Spider Active MEDIUM MEDIUM
SQL Injection Active MEDIUM MEDIUM
SQL Injection - MySQL Active MEDIUM MEDIUM
SQL Injection - Hypersonic SQL Active MEDIUM MEDIUM
SQL Injection - Oracle Active MEDIUM MEDIUM
SQL Injection - PostgreSQL Active MEDIUM MEDIUM
SQL Injection - SQLite Active MEDIUM MEDIUM
Cross Site Scripting (DOM Based) Active MEDIUM MEDIUM
SQL Injection - MsSQL Active MEDIUM MEDIUM
ELMAH Information Leak Active MEDIUM MEDIUM
Trace.axd Information Leak Active MEDIUM MEDIUM
XSLT Injection Active MEDIUM MEDIUM
.htaccess Information Leak Active MEDIUM MEDIUM
.env Information Leak Active MEDIUM MEDIUM
Server Side Code Injection Active MEDIUM MEDIUM
Hidden File Finder Active MEDIUM MEDIUM
XPath Injection Active MEDIUM MEDIUM
Remote OS Command Injection Active MEDIUM MEDIUM
XML External Entity Attack Active MEDIUM MEDIUM
Generic Padding Oracle Active MEDIUM MEDIUM
Spring Actuator Information Leak Active MEDIUM MEDIUM
SOAP Action Spoofing Active MEDIUM MEDIUM
Log4Shell Active MEDIUM MEDIUM
SOAP XML Injection Active MEDIUM MEDIUM
Spring4Shell Active MEDIUM MEDIUM
Heartbleed OpenSSL Vulnerability Active MEDIUM MEDIUM
Buffer Overflow Active MEDIUM MEDIUM
Source Code Disclosure - CVE-2012-1823 Active MEDIUM MEDIUM
Format String Error Active MEDIUM MEDIUM
Server Side Template Injection Active MEDIUM MEDIUM
Remote Code Execution - CVE-2012-1823 Active MEDIUM MEDIUM
Cloud Metadata Potentially Exposed Active MEDIUM MEDIUM
External Redirect Active MEDIUM MEDIUM
Server Side Template Injection (Blind) Active MEDIUM MEDIUM
Source Code Disclosure - /WEB-INF Folder Active MEDIUM MEDIUM
Verification Request Identified Passive MEDIUM -
Private IP Disclosure Passive MEDIUM -
Session ID in URL Rewrite Passive MEDIUM -
Insecure JSF ViewState Passive MEDIUM -
Vulnerable JS Library (Powered by Retire.js) Passive MEDIUM -
Cookie Without Secure Flag Passive MEDIUM -
Cross-Domain JavaScript Source File Inclusion Passive MEDIUM -
Content-Type Header Missing Passive MEDIUM -
Application Error Disclosure Passive MEDIUM -
Information Disclosure - Debug Error Messages Passive MEDIUM -
Information Disclosure - Sensitive Information in URL Passive MEDIUM -
Information Disclosure - Sensitive Information in HTTP Referrer Header Passive MEDIUM -
Open Redirect Passive MEDIUM -
User Controllable Charset Passive MEDIUM -
User Controllable HTML Element Attribute (Potential XSS) Passive MEDIUM -
WSDL File Detection Passive MEDIUM -
Loosely Scoped Cookie Passive MEDIUM -
Viewstate Passive MEDIUM -
Directory Browsing Passive MEDIUM -
Heartbleed OpenSSL Vulnerability (Indicative) Passive MEDIUM -
HTTP Server Response Header Passive MEDIUM -
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) Passive MEDIUM -
X-Backend-Server Header Information Leak Passive MEDIUM -
Secure Pages Include Mixed Content Passive MEDIUM -
HTTP to HTTPS Insecure Transition in Form Post Passive MEDIUM -
HTTPS to HTTP Insecure Transition in Form Post Passive MEDIUM -
User Controllable JavaScript Event (XSS) Passive MEDIUM -
Big Redirect Detected (Potential Sensitive Information Leak) Passive MEDIUM -
X-ChromeLogger-Data (XCOLD) Header Information Leak Passive MEDIUM -
CSP Passive MEDIUM -
X-Debug-Token Information Leak Passive MEDIUM -
Username Hash Found Passive MEDIUM -
X-AspNet-Version Response Header Passive MEDIUM -
PII Disclosure Passive MEDIUM -
Script Passive Scan Rules Passive MEDIUM -
Stats Passive Scan Rule Passive MEDIUM -
Timestamp Disclosure Passive MEDIUM -
Hash Disclosure Passive MEDIUM -
Cross-Domain Misconfiguration Passive MEDIUM -
Weak Authentication Method Passive MEDIUM -
Reverse Tabnabbing Passive MEDIUM -
Authentication Request Identified Passive MEDIUM -

Sites

https://google-gruyere.appspot.com

HTTP Response Code Number of Responses
404 Not Found
4
200 OK
24
302 Found
1
Authentication Statistics Number of Responses
!reports.report.stats.auth.sessiontoken.GRUYERE_ID!
2
Parameter Name Type Flags Times Used # Values

http://google-gruyere.appspot.com

HTTP Response Code Number of Responses
404 Not Found
79
200 OK
1767
302 Found
51
Authentication Statistics Number of Responses
!reports.report.stats.auth.sessiontoken.GRUYERE_ID!
96
!reports.report.stats.auth.sessiontoken.GRUYERE!
2
Parameter Name Type Flags Times Used # Values

Alert Detail

High
 Cross Site Scripting (Reflected)
Description
Cross-site Scripting (XSS) is an attack technique that involves echoing attacker-supplied code into a user's browser instance. A browser instance can be a standard web browser client, or a browser object embedded in a software product such as the browser within WinAmp, an RSS reader, or an email client. The code itself is usually written in HTML/JavaScript, but may also extend to VBScript, ActiveX, Java, Flash, or any other browser-supported technology.

When an attacker gets a user's browser to execute his/her code, the code will run within the security context (or zone) of the hosting web site. With this level of privilege, the code has the ability to read, modify and transmit any sensitive data accessible by the browser. A Cross-site Scripted user could have his/her account hijacked (cookie theft), their browser redirected to another location, or possibly shown fraudulent content delivered by the web site they are visiting. Cross-site Scripting attacks essentially compromise the trust relationship between a user and the web site. Applications utilizing browser object instances which load content from the file system may execute code under the local machine zone allowing for system compromise.

There are three types of Cross-site Scripting attacks: non-persistent, persistent and DOM-based.

Non-persistent attacks and DOM-based attacks require a user to either visit a specially crafted link laced with malicious code, or visit a malicious web page containing a web form, which when posted to the vulnerable site, will mount the attack. Using a malicious form will oftentimes take place when the vulnerable resource only accepts HTTP POST requests. In such a case, the form can be submitted automatically, without the victim's knowledge (e.g. by using JavaScript). Upon clicking on the malicious link or submitting the malicious form, the XSS payload will get echoed back and will get interpreted by the user's browser and execute. Another technique to send almost arbitrary requests (GET and POST) is by using an embedded client, such as Adobe Flash.

Persistent attacks occur when the malicious code is submitted to a web site where it's stored for a period of time. Examples of an attacker's favorite targets often include message board posts, web mail messages, and web chat software. The unsuspecting user is not required to interact with any additional site/link (e.g. an attacker site or a malicious link sent via email), just simply view the web page containing the code.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/snippets.gtl?uid=%3C%2Fh2%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Ch2%3E
Method GET
Parameter uid
Attack </h2><scrIpt>alert(1);</scRipt><h2>
Evidence </h2><scrIpt>alert(1);</scRipt><h2>
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,655 bytes.
Instances 1
Solution
Phase: Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.

Phases: Implementation; Architecture and Design

Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies.

For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters.

Consult the XSS Prevention Cheat Sheet for more details on the types of encoding and escaping that are needed.

Phase: Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.

Phase: Implementation

For every web page that is generated, use and specify a character encoding such as ISO-8859-1 or UTF-8. When an encoding is not specified, the web browser may choose a different encoding by guessing which encoding is actually being used by the web page. This can cause the web browser to treat certain sequences as special, opening up the client to subtle XSS attacks. See CWE-116 for more mitigations related to encoding/escaping.

To help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to malicious client-side scripts that use document.cookie. This is not a complete solution, since HttpOnly is not supported by all browsers. More importantly, XMLHTTPRequest and other powerful browser technologies provide read access to HTTP headers, including the Set-Cookie header in which the HttpOnly flag is set.

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use an allow list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. Do not rely exclusively on looking for malicious or malformed inputs (i.e., do not rely on a deny list). However, deny lists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if you are expecting colors such as "red" or "blue."

Ensure that you perform input validation at well-defined interfaces within the application. This will help protect the application even if a component is reused or moved elsewhere.
Reference https://owasp.org/www-community/attacks/xss/
https://cwe.mitre.org/data/definitions/79.html
Tags OWASP_2021_A03
WSTG-v42-INPV-01
OWASP_2017_A07
CWE Id 79
WASC Id 8
Plugin Id 40012
Medium
 Absence of Anti-CSRF Tokens
Description
No Anti-CSRF tokens were found in a HTML submission form.

A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.

CSRF attacks are effective in a number of situations, including:

* The victim has an active session on the target site.

* The victim is authenticated via HTTP auth on the target site.

* The victim is on the same local network as the target site.

CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter
Attack
Evidence <form method='get' action='/382665580745386307547168512335551204731/login'>
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,591 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login?pw=ZAP&uid=ZAP
Method GET
Parameter
Attack
Evidence <form method='get' action='/382665580745386307547168512335551204731/login'>
Request Header - size: 463 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,650 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter
Attack
Evidence <form method='get' action='/382665580745386307547168512335551204731/saveprofile'>
Request Header - size: 452 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,961 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login
Method GET
Parameter
Attack
Evidence <form method='get' action='/397587545265662818066921574239585949762/login'>
Request Header - size: 383 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,591 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter
Attack
Evidence <form method='get' action='/397587545265662818066921574239585949762/login'>
Request Header - size: 463 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,650 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/newaccount.gtl
Method GET
Parameter
Attack
Evidence <form method='get' action='/397587545265662818066921574239585949762/saveprofile'>
Request Header - size: 392 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,961 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter
Attack
Evidence <form method='get' action='/382665580745386307547168512335551204731/login'>
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,591 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter
Attack
Evidence <form method='get' action='/382665580745386307547168512335551204731/saveprofile'>
Request Header - size: 465 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,961 bytes.
Instances 8
Solution
Phase: Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

For example, use anti-CSRF packages such as the OWASP CSRFGuard.

Phase: Implementation

Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-controlled script.

Phase: Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).

Note that this can be bypassed using XSS.

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

Note that this can be bypassed using XSS.

Use the ESAPI Session Management control.

This control includes a component for CSRF.

Do not use the GET method for any request that triggers a state change.

Phase: Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
Reference https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
https://cwe.mitre.org/data/definitions/352.html
Tags OWASP_2021_A01
WSTG-v42-SESS-05
OWASP_2017_A05
CWE Id 352
WASC Id 9
Plugin Id 10202
Medium
 Content Security Policy (CSP) Header Not Set
Description
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
URL http://google-gruyere.appspot.com/
Method GET
Parameter
Attack
Evidence
Request Header - size: 359 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 11,506 bytes.
URL http://google-gruyere.appspot.com/0
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/1
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/2
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/3
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter
Attack
Evidence
Request Header - size: 437 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,480 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter
Attack
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,591 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login?pw=ZAP&uid=ZAP
Method GET
Parameter
Attack
Evidence
Request Header - size: 463 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,650 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 452 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,961 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/snippets.gtl?uid=brie
Method GET
Parameter
Attack
Evidence
Request Header - size: 459 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,059 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/snippets.gtl?uid=cheddar
Method GET
Parameter
Attack
Evidence
Request Header - size: 462 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,379 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter
Attack
Evidence
Request Header - size: 293 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,480 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login
Method GET
Parameter
Attack
Evidence
Request Header - size: 383 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,591 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter
Attack
Evidence
Request Header - size: 463 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,650 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/newaccount.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 392 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,961 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/snippets.gtl?uid=brie
Method GET
Parameter
Attack
Evidence
Request Header - size: 459 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,059 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/snippets.gtl?uid=cheddar
Method GET
Parameter
Attack
Evidence
Request Header - size: 402 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,379 bytes.
URL http://google-gruyere.appspot.com/4
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/5
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/6
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/7
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/8
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/9
Method GET
Parameter
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/code/
Method GET
Parameter
Attack
Evidence
Request Header - size: 368 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 354 bytes.
URL http://google-gruyere.appspot.com/code/?data.py
Method GET
Parameter
Attack
Evidence
Request Header - size: 376 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 367 bytes.
URL http://google-gruyere.appspot.com/code/?gruyere.py
Method GET
Parameter
Attack
Evidence
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 370 bytes.
URL http://google-gruyere.appspot.com/code/?gtl.py
Method GET
Parameter
Attack
Evidence
Request Header - size: 375 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 366 bytes.
URL http://google-gruyere.appspot.com/code/?resoources/dump.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 388 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 354 bytes.
URL http://google-gruyere.appspot.com/code/?resources/dump.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 378 bytes.
URL http://google-gruyere.appspot.com/code/?resources/editprofile.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 394 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 385 bytes.
URL http://google-gruyere.appspot.com/code/?resources/error.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 388 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 379 bytes.
URL http://google-gruyere.appspot.com/code/?resources/feed.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 378 bytes.
URL http://google-gruyere.appspot.com/code/?resources/home.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 378 bytes.
URL http://google-gruyere.appspot.com/code/?resources/manage.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 389 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 380 bytes.
URL http://google-gruyere.appspot.com/code/?resources/menubar.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 390 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 381 bytes.
URL http://google-gruyere.appspot.com/code/?sanitize.py
Method GET
Parameter
Attack
Evidence
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 371 bytes.
URL http://google-gruyere.appspot.com/code/data.py
Method GET
Parameter
Attack
Evidence
Request Header - size: 383 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 4,190 bytes.
URL http://google-gruyere.appspot.com/code/gruyere.py
Method GET
Parameter
Attack
Evidence
Request Header - size: 389 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 45,208 bytes.
URL http://google-gruyere.appspot.com/code/gtl.py
Method GET
Parameter
Attack
Evidence
Request Header - size: 381 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 15,231 bytes.
URL http://google-gruyere.appspot.com/code/resources/dump.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 405 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,337 bytes.
URL http://google-gruyere.appspot.com/code/resources/editprofile.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 419 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 7,482 bytes.
URL http://google-gruyere.appspot.com/code/resources/error.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 407 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 975 bytes.
URL http://google-gruyere.appspot.com/code/resources/feed.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 405 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,769 bytes.
URL http://google-gruyere.appspot.com/code/resources/home.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 405 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 3,533 bytes.
URL http://google-gruyere.appspot.com/code/resources/manage.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 409 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,499 bytes.
URL http://google-gruyere.appspot.com/code/resources/menubar.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 411 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,889 bytes.
URL http://google-gruyere.appspot.com/code/sanitize.py
Method GET
Parameter
Attack
Evidence
Request Header - size: 391 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 4,996 bytes.
URL http://google-gruyere.appspot.com/part1
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 13,686 bytes.
URL http://google-gruyere.appspot.com/part2
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 37,564 bytes.
URL http://google-gruyere.appspot.com/part3
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 29,253 bytes.
URL http://google-gruyere.appspot.com/part4
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 24,149 bytes.
URL http://google-gruyere.appspot.com/part5
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 25,303 bytes.
URL http://google-gruyere.appspot.com/start
Method GET
Parameter
Attack
Evidence
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 354 bytes.
Response Body - size: 681 bytes.
URL http://google-gruyere.appspot.com/static/codeindex.html
Method GET
Parameter
Attack
Evidence
Request Header - size: 384 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 2,188 bytes.
URL http://google-gruyere.appspot.com/static/codeindex/html
Method GET
Parameter
Attack
Evidence
Request Header - size: 384 bytes.
Request Body - size: 0 bytes.
Response Header - size: 206 bytes.
Response Body - size: 298 bytes.
URL https://google-gruyere.appspot.com/
Method GET
Parameter
Attack
Evidence
Request Header - size: 364 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 11,506 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter
Attack
Evidence
Request Header - size: 451 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 3,480 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/feed.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 412 bytes.
Request Body - size: 0 bytes.
Response Header - size: 305 bytes.
Response Body - size: 191 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,591 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 465 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,961 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/quitserver.
Method GET
Parameter
Attack
Evidence
Request Header - size: 415 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,246 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/RESET.
Method GET
Parameter
Attack
Evidence
Request Header - size: 410 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,241 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True
Method GET
Parameter
Attack
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True&uid=username
Method GET
Parameter
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/code/
Method GET
Parameter
Attack
Evidence
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 303 bytes.
Response Body - size: 354 bytes.
URL https://google-gruyere.appspot.com/part1
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 13,686 bytes.
URL https://google-gruyere.appspot.com/part2
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 37,564 bytes.
URL https://google-gruyere.appspot.com/part3
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 29,253 bytes.
URL https://google-gruyere.appspot.com/part4
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 24,149 bytes.
URL https://google-gruyere.appspot.com/part5
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 25,303 bytes.
URL https://google-gruyere.appspot.com/start
Method GET
Parameter
Attack
Evidence
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 281 bytes.
Response Body - size: 756 bytes.
URL https://google-gruyere.appspot.com/static/codeindex.html
Method GET
Parameter
Attack
Evidence
Request Header - size: 386 bytes.
Request Body - size: 0 bytes.
Response Header - size: 334 bytes.
Response Body - size: 2,188 bytes.
URL https://google-gruyere.appspot.com/static/codeindex/html
Method GET
Parameter
Attack
Evidence
Request Header - size: 386 bytes.
Request Body - size: 0 bytes.
Response Header - size: 263 bytes.
Response Body - size: 298 bytes.
Instances 75
Solution
Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
Reference https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
https://www.w3.org/TR/CSP/
https://w3c.github.io/webappsec-csp/
https://web.dev/articles/csp
https://caniuse.com/#feat=contentsecuritypolicy
https://content-security-policy.com/
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 693
WASC Id 15
Plugin Id 10038
Medium
 Missing Anti-clickjacking Header
Description
The response does not include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options to protect against 'ClickJacking' attacks.
URL http://google-gruyere.appspot.com/
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 359 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 11,506 bytes.
URL http://google-gruyere.appspot.com/0
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/1
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/2
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/3
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 437 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,480 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,591 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login?pw=ZAP&uid=ZAP
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 463 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,650 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 452 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,961 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/snippets.gtl?uid=brie
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 459 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,059 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/snippets.gtl?uid=cheddar
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 462 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,379 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 293 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,480 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 383 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,591 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 463 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,650 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/newaccount.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 392 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,961 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/snippets.gtl?uid=brie
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 459 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,059 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/snippets.gtl?uid=cheddar
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 402 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,379 bytes.
URL http://google-gruyere.appspot.com/4
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/5
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/6
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/7
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/8
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/9
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/code/
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 368 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 354 bytes.
URL http://google-gruyere.appspot.com/code/?data.py
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 376 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 367 bytes.
URL http://google-gruyere.appspot.com/code/?gruyere.py
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 370 bytes.
URL http://google-gruyere.appspot.com/code/?gtl.py
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 375 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 366 bytes.
URL http://google-gruyere.appspot.com/code/?resoources/dump.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 388 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 354 bytes.
URL http://google-gruyere.appspot.com/code/?resources/dump.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 378 bytes.
URL http://google-gruyere.appspot.com/code/?resources/editprofile.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 394 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 385 bytes.
URL http://google-gruyere.appspot.com/code/?resources/error.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 388 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 379 bytes.
URL http://google-gruyere.appspot.com/code/?resources/feed.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 378 bytes.
URL http://google-gruyere.appspot.com/code/?resources/home.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 378 bytes.
URL http://google-gruyere.appspot.com/code/?resources/manage.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 389 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 380 bytes.
URL http://google-gruyere.appspot.com/code/?resources/menubar.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 390 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 381 bytes.
URL http://google-gruyere.appspot.com/code/?sanitize.py
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 371 bytes.
URL http://google-gruyere.appspot.com/code/data.py
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 383 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 4,190 bytes.
URL http://google-gruyere.appspot.com/code/gruyere.py
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 389 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 45,208 bytes.
URL http://google-gruyere.appspot.com/code/gtl.py
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 381 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 15,231 bytes.
URL http://google-gruyere.appspot.com/code/resources/dump.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 405 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,337 bytes.
URL http://google-gruyere.appspot.com/code/resources/editprofile.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 419 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 7,482 bytes.
URL http://google-gruyere.appspot.com/code/resources/error.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 407 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 975 bytes.
URL http://google-gruyere.appspot.com/code/resources/feed.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 405 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,769 bytes.
URL http://google-gruyere.appspot.com/code/resources/home.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 405 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 3,533 bytes.
URL http://google-gruyere.appspot.com/code/resources/manage.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 409 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,499 bytes.
URL http://google-gruyere.appspot.com/code/resources/menubar.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 411 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,889 bytes.
URL http://google-gruyere.appspot.com/code/sanitize.py
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 391 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 4,996 bytes.
URL http://google-gruyere.appspot.com/part1
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 13,686 bytes.
URL http://google-gruyere.appspot.com/part2
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 37,564 bytes.
URL http://google-gruyere.appspot.com/part3
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 29,253 bytes.
URL http://google-gruyere.appspot.com/part4
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 24,149 bytes.
URL http://google-gruyere.appspot.com/part5
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 25,303 bytes.
URL http://google-gruyere.appspot.com/start
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 354 bytes.
Response Body - size: 681 bytes.
URL http://google-gruyere.appspot.com/static/codeindex.html
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 384 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 2,188 bytes.
URL https://google-gruyere.appspot.com/
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 364 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 11,506 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 451 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 3,480 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/feed.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 412 bytes.
Request Body - size: 0 bytes.
Response Header - size: 305 bytes.
Response Body - size: 191 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,591 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 465 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,961 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/quitserver.
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 415 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,246 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/RESET.
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 410 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,241 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True&uid=username
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/code/
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 303 bytes.
Response Body - size: 354 bytes.
URL https://google-gruyere.appspot.com/part1
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 13,686 bytes.
URL https://google-gruyere.appspot.com/part2
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 37,564 bytes.
URL https://google-gruyere.appspot.com/part3
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 29,253 bytes.
URL https://google-gruyere.appspot.com/part4
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 24,149 bytes.
URL https://google-gruyere.appspot.com/part5
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 25,303 bytes.
URL https://google-gruyere.appspot.com/start
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 281 bytes.
Response Body - size: 756 bytes.
URL https://google-gruyere.appspot.com/static/codeindex.html
Method GET
Parameter x-frame-options
Attack
Evidence
Request Header - size: 386 bytes.
Request Body - size: 0 bytes.
Response Header - size: 334 bytes.
Response Body - size: 2,188 bytes.
Instances 73
Solution
Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app.

If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's "frame-ancestors" directive.
Reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
Tags OWASP_2021_A05
WSTG-v42-CLNT-09
OWASP_2017_A06
CWE Id 1021
WASC Id 15
Plugin Id 10020
Low
 Cookie No HttpOnly Flag
Description
A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter GRUYERE
Attack
Evidence Set-Cookie: GRUYERE
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter GRUYERE
Attack
Evidence Set-Cookie: GRUYERE
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/start
Method GET
Parameter GRUYERE_ID
Attack
Evidence Set-Cookie: GRUYERE_ID
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 354 bytes.
Response Body - size: 681 bytes.
Instances 3
Solution
Ensure that the HttpOnly flag is set for all cookies.
Reference https://owasp.org/www-community/HttpOnly
Tags OWASP_2021_A05
WSTG-v42-SESS-02
OWASP_2017_A06
CWE Id 1004
WASC Id 13
Plugin Id 10010
Low
 Cookie without SameSite Attribute
Description
A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter GRUYERE
Attack
Evidence Set-Cookie: GRUYERE
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter GRUYERE
Attack
Evidence Set-Cookie: GRUYERE
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/start
Method GET
Parameter GRUYERE_ID
Attack
Evidence Set-Cookie: GRUYERE_ID
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 354 bytes.
Response Body - size: 681 bytes.
Instances 3
Solution
Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.
Reference https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site
Tags OWASP_2021_A01
WSTG-v42-SESS-02
OWASP_2017_A05
CWE Id 1275
WASC Id 13
Plugin Id 10054
Low
 Strict-Transport-Security Header Not Set
Description
HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797.
URL https://google-gruyere.appspot.com/
Method GET
Parameter
Attack
Evidence
Request Header - size: 364 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 11,506 bytes.
URL https://google-gruyere.appspot.com/%C9%A1ru%CB%90%CB%88j%C9%9B%C9%99r/
Method GET
Parameter
Attack
Evidence
Request Header - size: 395 bytes.
Request Body - size: 0 bytes.
Response Header - size: 263 bytes.
Response Body - size: 52 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter
Attack
Evidence
Request Header - size: 451 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 3,480 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/feed.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 412 bytes.
Request Body - size: 0 bytes.
Response Header - size: 305 bytes.
Response Body - size: 191 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,591 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter
Attack
Evidence
Request Header - size: 465 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,961 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/quitserver.
Method GET
Parameter
Attack
Evidence
Request Header - size: 415 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,246 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/RESET.
Method GET
Parameter
Attack
Evidence
Request Header - size: 410 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,241 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True
Method GET
Parameter
Attack
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True&uid=username
Method GET
Parameter
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/code/
Method GET
Parameter
Attack
Evidence
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 303 bytes.
Response Body - size: 354 bytes.
URL https://google-gruyere.appspot.com/gruyere-code.zip
Method GET
Parameter
Attack
Evidence
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 341 bytes.
Response Body - size: 35,401 bytes.
URL https://google-gruyere.appspot.com/gruyere-code.zip.
Method GET
Parameter
Attack
Evidence
Request Header - size: 381 bytes.
Request Body - size: 0 bytes.
Response Header - size: 263 bytes.
Response Body - size: 52 bytes.
URL https://google-gruyere.appspot.com/part1
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 13,686 bytes.
URL https://google-gruyere.appspot.com/part2
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 37,564 bytes.
URL https://google-gruyere.appspot.com/part3
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 29,253 bytes.
URL https://google-gruyere.appspot.com/part4
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 24,149 bytes.
URL https://google-gruyere.appspot.com/part5
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 25,303 bytes.
URL https://google-gruyere.appspot.com/start
Method GET
Parameter
Attack
Evidence
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 281 bytes.
Response Body - size: 756 bytes.
URL https://google-gruyere.appspot.com/start.
Method GET
Parameter
Attack
Evidence
Request Header - size: 370 bytes.
Request Body - size: 0 bytes.
Response Header - size: 263 bytes.
Response Body - size: 52 bytes.
URL https://google-gruyere.appspot.com/static/cheese_b.png
Method GET
Parameter
Attack
Evidence
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 333 bytes.
Response Body - size: 682 bytes.
URL https://google-gruyere.appspot.com/static/cheese_bw.png
Method GET
Parameter
Attack
Evidence
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 333 bytes.
Response Body - size: 740 bytes.
URL https://google-gruyere.appspot.com/static/cheese_w.png
Method GET
Parameter
Attack
Evidence
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 333 bytes.
Response Body - size: 727 bytes.
URL https://google-gruyere.appspot.com/static/codeindex.html
Method GET
Parameter
Attack
Evidence
Request Header - size: 386 bytes.
Request Body - size: 0 bytes.
Response Header - size: 334 bytes.
Response Body - size: 2,188 bytes.
URL https://google-gruyere.appspot.com/static/codeindex/html
Method GET
Parameter
Attack
Evidence
Request Header - size: 386 bytes.
Request Body - size: 0 bytes.
Response Header - size: 263 bytes.
Response Body - size: 298 bytes.
URL https://google-gruyere.appspot.com/static/codelab.css
Method GET
Parameter
Attack
Evidence
Request Header - size: 378 bytes.
Request Body - size: 0 bytes.
Response Header - size: 333 bytes.
Response Body - size: 1,774 bytes.
URL https://google-gruyere.appspot.com/static/gruyere-78.png
Method GET
Parameter
Attack
Evidence
Request Header - size: 381 bytes.
Request Body - size: 0 bytes.
Response Header - size: 334 bytes.
Response Body - size: 2,527 bytes.
URL https://google-gruyere.appspot.com/static/gruyere.png
Method GET
Parameter
Attack
Evidence
Request Header - size: 378 bytes.
Request Body - size: 0 bytes.
Response Header - size: 335 bytes.
Response Body - size: 40,079 bytes.
Instances 28
Solution
Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.
Reference https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
https://owasp.org/www-community/Security_Headers
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
https://caniuse.com/stricttransportsecurity
https://datatracker.ietf.org/doc/html/rfc6797
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 319
WASC Id 15
Plugin Id 10035
Low
 X-Content-Type-Options Header Missing
Description
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.
URL http://google-gruyere.appspot.com/
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 359 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 11,506 bytes.
URL http://google-gruyere.appspot.com/0
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/1
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/2
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/3
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 437 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,480 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/lib.js
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 444 bytes.
Request Body - size: 0 bytes.
Response Header - size: 256 bytes.
Response Body - size: 1,962 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,591 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login?pw=ZAP&uid=ZAP
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 463 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,650 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 452 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,961 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/snippets.gtl?uid=brie
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 459 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,059 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/snippets.gtl?uid=cheddar
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 462 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,379 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 293 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,480 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/lib.js
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 444 bytes.
Request Body - size: 0 bytes.
Response Header - size: 256 bytes.
Response Body - size: 1,962 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 383 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,591 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 463 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,650 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/newaccount.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 392 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,961 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/snippets.gtl?uid=brie
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 459 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,059 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/snippets.gtl?uid=cheddar
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 402 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,379 bytes.
URL http://google-gruyere.appspot.com/4
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/5
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/6
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/7
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/8
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/9
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 359 bytes.
URL http://google-gruyere.appspot.com/code/
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 368 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 354 bytes.
URL http://google-gruyere.appspot.com/code/?data.py
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 376 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 367 bytes.
URL http://google-gruyere.appspot.com/code/?gruyere.py
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 370 bytes.
URL http://google-gruyere.appspot.com/code/?gtl.py
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 375 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 366 bytes.
URL http://google-gruyere.appspot.com/code/?resoources/dump.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 388 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 354 bytes.
URL http://google-gruyere.appspot.com/code/?resources/dump.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 378 bytes.
URL http://google-gruyere.appspot.com/code/?resources/editprofile.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 394 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 385 bytes.
URL http://google-gruyere.appspot.com/code/?resources/error.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 388 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 379 bytes.
URL http://google-gruyere.appspot.com/code/?resources/feed.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 378 bytes.
URL http://google-gruyere.appspot.com/code/?resources/home.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 378 bytes.
URL http://google-gruyere.appspot.com/code/?resources/manage.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 389 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 380 bytes.
URL http://google-gruyere.appspot.com/code/?resources/menubar.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 390 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 381 bytes.
URL http://google-gruyere.appspot.com/code/?sanitize.py
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 371 bytes.
URL http://google-gruyere.appspot.com/code/data.py
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 383 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 4,190 bytes.
URL http://google-gruyere.appspot.com/code/gruyere.py
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 389 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 45,208 bytes.
URL http://google-gruyere.appspot.com/code/gtl.py
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 381 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 15,231 bytes.
URL http://google-gruyere.appspot.com/code/resources/dump.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 405 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,337 bytes.
URL http://google-gruyere.appspot.com/code/resources/editprofile.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 419 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 7,482 bytes.
URL http://google-gruyere.appspot.com/code/resources/error.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 407 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 975 bytes.
URL http://google-gruyere.appspot.com/code/resources/feed.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 405 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,769 bytes.
URL http://google-gruyere.appspot.com/code/resources/home.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 405 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 3,533 bytes.
URL http://google-gruyere.appspot.com/code/resources/manage.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 409 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,499 bytes.
URL http://google-gruyere.appspot.com/code/resources/menubar.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 411 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 1,889 bytes.
URL http://google-gruyere.appspot.com/code/sanitize.py
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 391 bytes.
Request Body - size: 0 bytes.
Response Header - size: 243 bytes.
Response Body - size: 4,996 bytes.
URL http://google-gruyere.appspot.com/gruyere-code.zip
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 284 bytes.
Response Body - size: 35,401 bytes.
URL http://google-gruyere.appspot.com/part1
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 13,686 bytes.
URL http://google-gruyere.appspot.com/part2
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 37,564 bytes.
URL http://google-gruyere.appspot.com/part3
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 29,253 bytes.
URL http://google-gruyere.appspot.com/part4
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 24,149 bytes.
URL http://google-gruyere.appspot.com/part5
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 25,303 bytes.
URL http://google-gruyere.appspot.com/robots.txt
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 263 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 184 bytes.
URL http://google-gruyere.appspot.com/start
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 354 bytes.
Response Body - size: 681 bytes.
URL http://google-gruyere.appspot.com/static/cheese_b.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 377 bytes.
Request Body - size: 0 bytes.
Response Header - size: 286 bytes.
Response Body - size: 682 bytes.
URL http://google-gruyere.appspot.com/static/cheese_bw.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 378 bytes.
Request Body - size: 0 bytes.
Response Header - size: 276 bytes.
Response Body - size: 740 bytes.
URL http://google-gruyere.appspot.com/static/cheese_w.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 377 bytes.
Request Body - size: 0 bytes.
Response Header - size: 286 bytes.
Response Body - size: 727 bytes.
URL http://google-gruyere.appspot.com/static/closed.gif
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 275 bytes.
Response Body - size: 72 bytes.
URL http://google-gruyere.appspot.com/static/codeindex.html
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 384 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 2,188 bytes.
URL http://google-gruyere.appspot.com/static/codelab.css
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 376 bytes.
Request Body - size: 0 bytes.
Response Header - size: 276 bytes.
Response Body - size: 1,774 bytes.
URL http://google-gruyere.appspot.com/static/gruyere-40.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 384 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 1,181 bytes.
URL http://google-gruyere.appspot.com/static/gruyere-78.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 2,527 bytes.
URL http://google-gruyere.appspot.com/static/gruyere-badge.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 2,872 bytes.
URL http://google-gruyere.appspot.com/static/gruyere.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 376 bytes.
Request Body - size: 0 bytes.
Response Header - size: 288 bytes.
Response Body - size: 40,079 bytes.
URL https://google-gruyere.appspot.com/
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 364 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 11,506 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 451 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 3,480 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/feed.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 412 bytes.
Request Body - size: 0 bytes.
Response Header - size: 305 bytes.
Response Body - size: 191 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,591 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 465 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,961 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/quitserver.
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 415 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,246 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/RESET.
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 410 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,241 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True&uid=username
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/code/
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 303 bytes.
Response Body - size: 354 bytes.
URL https://google-gruyere.appspot.com/gruyere-code.zip
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 341 bytes.
Response Body - size: 35,401 bytes.
URL https://google-gruyere.appspot.com/part1
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 13,686 bytes.
URL https://google-gruyere.appspot.com/part2
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 37,564 bytes.
URL https://google-gruyere.appspot.com/part3
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 29,253 bytes.
URL https://google-gruyere.appspot.com/part4
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 24,149 bytes.
URL https://google-gruyere.appspot.com/part5
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 25,303 bytes.
URL https://google-gruyere.appspot.com/start
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 281 bytes.
Response Body - size: 756 bytes.
URL https://google-gruyere.appspot.com/static/cheese_b.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 333 bytes.
Response Body - size: 682 bytes.
URL https://google-gruyere.appspot.com/static/cheese_bw.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 333 bytes.
Response Body - size: 740 bytes.
URL https://google-gruyere.appspot.com/static/cheese_w.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 333 bytes.
Response Body - size: 727 bytes.
URL https://google-gruyere.appspot.com/static/codeindex.html
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 386 bytes.
Request Body - size: 0 bytes.
Response Header - size: 334 bytes.
Response Body - size: 2,188 bytes.
URL https://google-gruyere.appspot.com/static/codelab.css
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 378 bytes.
Request Body - size: 0 bytes.
Response Header - size: 333 bytes.
Response Body - size: 1,774 bytes.
URL https://google-gruyere.appspot.com/static/gruyere-78.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 381 bytes.
Request Body - size: 0 bytes.
Response Header - size: 334 bytes.
Response Body - size: 2,527 bytes.
URL https://google-gruyere.appspot.com/static/gruyere.png
Method GET
Parameter x-content-type-options
Attack
Evidence
Request Header - size: 378 bytes.
Request Body - size: 0 bytes.
Response Header - size: 335 bytes.
Response Body - size: 40,079 bytes.
Instances 93
Solution
Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Reference https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)
https://owasp.org/www-community/Security_Headers
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 693
WASC Id 15
Plugin Id 10021
Informational
 Charset Mismatch (Header Versus Meta Content-Type Charset)
Description
This check identifies responses where the HTTP Content-Type header declares a charset different from the charset defined by the body of the HTML or XML. When there's a charset mismatch between the HTTP header and content body Web browsers can be forced into an undesirable content-sniffing mode to determine the content's correct character set.

An attacker could manipulate content on the page to be interpreted in an encoding of their choice. For example, if an attacker can control content at the beginning of the page, they could inject script using UTF-7 encoded text and manipulate some browsers into interpreting that text.
URL http://google-gruyere.appspot.com/
Method GET
Parameter
Attack
Evidence
Request Header - size: 359 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 11,506 bytes.
URL http://google-gruyere.appspot.com/part1
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 13,686 bytes.
URL http://google-gruyere.appspot.com/part2
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 37,564 bytes.
URL http://google-gruyere.appspot.com/part3
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 29,253 bytes.
URL http://google-gruyere.appspot.com/part4
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 24,149 bytes.
URL http://google-gruyere.appspot.com/part5
Method GET
Parameter
Attack
Evidence
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 25,303 bytes.
URL https://google-gruyere.appspot.com/
Method GET
Parameter
Attack
Evidence
Request Header - size: 364 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 11,506 bytes.
URL https://google-gruyere.appspot.com/part1
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 13,686 bytes.
URL https://google-gruyere.appspot.com/part2
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 37,564 bytes.
URL https://google-gruyere.appspot.com/part3
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 29,253 bytes.
URL https://google-gruyere.appspot.com/part4
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 24,149 bytes.
URL https://google-gruyere.appspot.com/part5
Method GET
Parameter
Attack
Evidence
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 25,303 bytes.
Instances 12
Solution
Force UTF-8 for all text content in both the HTTP header and meta tags in HTML or encoding declarations in XML.
Reference https://code.google.com/p/browsersec/wiki/Part2#Character_set_handling_and_detection
Tags
CWE Id 436
WASC Id 15
Plugin Id 90011
Informational
 Cookie Poisoning
Description
This check looks at user-supplied input in query string parameters and POST data to identify where cookie parameters might be controlled. This is called a cookie poisoning attack, and becomes exploitable when an attacker can manipulate the cookie in various ways. In some cases this will not be exploitable, however, allowing URL parameters to set cookie values is generally considered a bug.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter pw
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter uid
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter pw
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter uid
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
Instances 4
Solution
Do not allow user input to control cookie names and values. If some query string parameters must be set in cookie values, be sure to filter out semicolon's that can serve as name/value pair delimiters.
Reference https://en.wikipedia.org/wiki/HTTP_cookie
https://cwe.mitre.org/data/definitions/565.html
Tags OWASP_2021_A03
OWASP_2017_A01
CWE Id 565
WASC Id 20
Plugin Id 10029
Informational
 Information Disclosure - Suspicious Comments
Description
The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/lib.js
Method GET
Parameter
Attack
Evidence user
Request Header - size: 444 bytes.
Request Body - size: 0 bytes.
Response Header - size: 256 bytes.
Response Body - size: 1,962 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/lib.js
Method GET
Parameter
Attack
Evidence user
Request Header - size: 444 bytes.
Request Body - size: 0 bytes.
Response Header - size: 256 bytes.
Response Body - size: 1,962 bytes.
Instances 2
Solution
Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.
Reference
Tags OWASP_2021_A01
WSTG-v42-INFO-05
OWASP_2017_A03
CWE Id 200
WASC Id 13
Plugin Id 10027
Informational
 Modern Web Application
Description
The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
URL http://google-gruyere.appspot.com/
Method GET
Parameter
Attack
Evidence <A name="0__hackers"></A>
Request Header - size: 359 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 11,506 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter
Attack
Evidence <a class='button' onclick='_refreshHome("382665580745386307547168512335551204731")' href='#'>Refresh</a>
Request Header - size: 437 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,480 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/snippets.gtl?uid=brie
Method GET
Parameter
Attack
Evidence <a class='button' onclick='_refreshSnippets("382665580745386307547168512335551204731", "brie")' href='#'>Refresh</a>
Request Header - size: 459 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,059 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/snippets.gtl?uid=cheddar
Method GET
Parameter
Attack
Evidence <a class='button' onclick='_refreshSnippets("382665580745386307547168512335551204731", "cheddar")' href='#'>Refresh</a>
Request Header - size: 462 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,379 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter
Attack
Evidence <a class='button' onclick='_refreshHome("397587545265662818066921574239585949762")' href='#'>Refresh</a>
Request Header - size: 293 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,480 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/snippets.gtl?uid=brie
Method GET
Parameter
Attack
Evidence <a class='button' onclick='_refreshSnippets("397587545265662818066921574239585949762", "brie")' href='#'>Refresh</a>
Request Header - size: 459 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,059 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/snippets.gtl?uid=cheddar
Method GET
Parameter
Attack
Evidence <a class='button' onclick='_refreshSnippets("397587545265662818066921574239585949762", "cheddar")' href='#'>Refresh</a>
Request Header - size: 402 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,379 bytes.
URL http://google-gruyere.appspot.com/part1
Method GET
Parameter
Attack
Evidence <A name="1__setup"> </A>
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 13,686 bytes.
URL http://google-gruyere.appspot.com/part2
Method GET
Parameter
Attack
Evidence <A name="2__cross_site_scripting"> </A>
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 37,564 bytes.
URL http://google-gruyere.appspot.com/part3
Method GET
Parameter
Attack
Evidence <A name="3__client_state_manipulation"> </A>
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 29,253 bytes.
URL http://google-gruyere.appspot.com/part4
Method GET
Parameter
Attack
Evidence <A name="4__path_traversal"> </A>
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 24,149 bytes.
URL http://google-gruyere.appspot.com/part5
Method GET
Parameter
Attack
Evidence <A name="5__configuration_vulnerabilities"> </A>
Request Header - size: 363 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 25,303 bytes.
URL https://google-gruyere.appspot.com/
Method GET
Parameter
Attack
Evidence <A name="0__hackers"></A>
Request Header - size: 364 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 11,506 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter
Attack
Evidence <a class='button' onclick='_refreshHome("382665580745386307547168512335551204731")' href='#'>Refresh</a>
Request Header - size: 451 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 3,480 bytes.
URL https://google-gruyere.appspot.com/part1
Method GET
Parameter
Attack
Evidence <A name="1__setup"> </A>
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 13,686 bytes.
URL https://google-gruyere.appspot.com/part2
Method GET
Parameter
Attack
Evidence <A name="2__cross_site_scripting"> </A>
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 37,564 bytes.
URL https://google-gruyere.appspot.com/part3
Method GET
Parameter
Attack
Evidence <A name="3__client_state_manipulation"> </A>
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 29,253 bytes.
URL https://google-gruyere.appspot.com/part4
Method GET
Parameter
Attack
Evidence <A name="4__path_traversal"> </A>
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 24,149 bytes.
URL https://google-gruyere.appspot.com/part5
Method GET
Parameter
Attack
Evidence <A name="5__configuration_vulnerabilities"> </A>
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 25,303 bytes.
Instances 19
Solution
This is an informational alert and so no changes are required.
Reference
Tags
CWE Id
WASC Id
Plugin Id 10109
Informational
 Re-examine Cache-control Directives
Description
The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached.
URL https://google-gruyere.appspot.com/
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 364 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 11,506 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 451 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 3,480 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/feed.gtl
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 412 bytes.
Request Body - size: 0 bytes.
Response Header - size: 305 bytes.
Response Body - size: 191 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,591 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/newaccount.gtl
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 465 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,961 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/quitserver.
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 415 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,246 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/RESET.
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 410 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,241 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True&uid=username
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
URL https://google-gruyere.appspot.com/code/
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 303 bytes.
Response Body - size: 354 bytes.
URL https://google-gruyere.appspot.com/part1
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 13,686 bytes.
URL https://google-gruyere.appspot.com/part2
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 37,564 bytes.
URL https://google-gruyere.appspot.com/part3
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 29,253 bytes.
URL https://google-gruyere.appspot.com/part4
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 24,149 bytes.
URL https://google-gruyere.appspot.com/part5
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 365 bytes.
Request Body - size: 0 bytes.
Response Header - size: 301 bytes.
Response Body - size: 25,303 bytes.
URL https://google-gruyere.appspot.com/start
Method GET
Parameter cache-control
Attack
Evidence no-cache
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 281 bytes.
Response Body - size: 756 bytes.
URL https://google-gruyere.appspot.com/static/codeindex.html
Method GET
Parameter cache-control
Attack
Evidence public, max-age=600
Request Header - size: 386 bytes.
Request Body - size: 0 bytes.
Response Header - size: 334 bytes.
Response Body - size: 2,188 bytes.
Instances 17
Solution
For secure content, ensure the cache-control HTTP header is set with "no-cache, no-store, must-revalidate". If an asset should be cached consider setting the directives "public, max-age, immutable".
Reference https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
https://grayduck.mn/2021/09/13/cache-control-recommendations/
Tags WSTG-v42-ATHN-06
CWE Id 525
WASC Id 13
Plugin Id 10015
Informational
 Retrieved from Cache
Description
The content was retrieved from a shared cache. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where caching servers such as "proxy" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
URL http://google-gruyere.appspot.com/static/cheese_b.png
Method GET
Parameter
Attack
Evidence Age: 238
Request Header - size: 377 bytes.
Request Body - size: 0 bytes.
Response Header - size: 286 bytes.
Response Body - size: 682 bytes.
URL http://google-gruyere.appspot.com/static/cheese_w.png
Method GET
Parameter
Attack
Evidence Age: 237
Request Header - size: 377 bytes.
Request Body - size: 0 bytes.
Response Header - size: 286 bytes.
Response Body - size: 727 bytes.
URL http://google-gruyere.appspot.com/static/gruyere.png
Method GET
Parameter
Attack
Evidence Age: 238
Request Header - size: 376 bytes.
Request Body - size: 0 bytes.
Response Header - size: 288 bytes.
Response Body - size: 40,079 bytes.
Instances 3
Solution
Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:

Cache-Control: no-cache, no-store, must-revalidate, private

Pragma: no-cache

Expires: 0

This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
Reference https://tools.ietf.org/html/rfc7234
https://tools.ietf.org/html/rfc7231
https://www.rfc-editor.org/rfc/rfc9110.html
Tags WSTG-v42-ATHN-06
CWE Id
WASC Id
Plugin Id 10050
Informational
 Session Management Response Identified
Description
The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to "Auto-Detect" then this rule will change the session management to use the tokens identified.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter GRUYERE
Attack
Evidence 26087470|ZAP||author
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter GRUYERE
Attack
Evidence 26087470|ZAP||author
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/start
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 354 bytes.
Response Body - size: 681 bytes.
URL http://google-gruyere.appspot.com/,
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 364 bytes.
Request Body - size: 0 bytes.
Response Header - size: 206 bytes.
Response Body - size: 52 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,591 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/login?pw=ZAP&uid=ZAP
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 463 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,650 bytes.
URL http://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 2,224 bytes.
URL http://google-gruyere.appspot.com/Applications
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 375 bytes.
Request Body - size: 0 bytes.
Response Header - size: 14 bytes.
Response Body - size: 0 bytes.
URL http://google-gruyere.appspot.com/code/?resoources/dump.gtl
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 388 bytes.
Request Body - size: 0 bytes.
Response Header - size: 242 bytes.
Response Body - size: 354 bytes.
URL http://google-gruyere.appspot.com/code/gruyere.py
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 389 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 45,208 bytes.
URL http://google-gruyere.appspot.com/gtl.py
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 369 bytes.
Request Body - size: 0 bytes.
Response Header - size: 206 bytes.
Response Body - size: 52 bytes.
URL http://google-gruyere.appspot.com/opt/google/chrome
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 14 bytes.
Response Body - size: 0 bytes.
URL http://google-gruyere.appspot.com/static/closed.gif
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 380 bytes.
Request Body - size: 0 bytes.
Response Header - size: 275 bytes.
Response Body - size: 72 bytes.
URL http://google-gruyere.appspot.com/static/codeindex
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 379 bytes.
Request Body - size: 0 bytes.
Response Header - size: 14 bytes.
Response Body - size: 0 bytes.
URL http://google-gruyere.appspot.com/static/codeindex.html
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 384 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 2,188 bytes.
URL http://google-gruyere.appspot.com/static/gruyere-40.png
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 384 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 1,181 bytes.
URL http://google-gruyere.appspot.com/static/gruyere-badge.png
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 387 bytes.
Request Body - size: 0 bytes.
Response Header - size: 277 bytes.
Response Body - size: 2,872 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 403 bytes.
Request Body - size: 0 bytes.
Response Header - size: 14 bytes.
Response Body - size: 0 bytes.
URL https://google-gruyere.appspot.com/382665580745386307547168512335551204731/saveprofile?action=update&is_admin=True&uid=username
Method GET
Parameter GRUYERE_ID
Attack
Evidence 382665580745386307547168512335551204731
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 306 bytes.
Response Body - size: 2,228 bytes.
Instances 19
Solution
This is an informational alert rather than a vulnerability and so there is nothing to fix.
Reference https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id
Tags
CWE Id
WASC Id
Plugin Id 10112
Informational
 User Agent Fuzzer
Description
Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 231 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 231 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 231 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 243 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 296 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 259 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 253 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 264 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 317 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 322 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 227 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 232 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 232 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 232 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 244 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 310 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 297 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 260 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 254 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 265 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 318 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 323 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 228 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 3,888 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 402 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 402 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 402 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 414 bytes.
Request Body - size: 0 bytes.
Response Header - size: 382 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 480 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 467 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 430 bytes.
Request Body - size: 0 bytes.
Response Header - size: 382 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 424 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 435 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 488 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 493 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/login?pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 398 bytes.
Request Body - size: 0 bytes.
Response Header - size: 378 bytes.
Response Body - size: 4,245 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 443 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 455 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 521 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 508 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 471 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 465 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 476 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 529 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 534 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
URL http://google-gruyere.appspot.com/397587545265662818066921574239585949762/saveprofile?action=new&is_author=True&pw=ZAP&uid=ZAP
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 439 bytes.
Request Body - size: 0 bytes.
Response Header - size: 249 bytes.
Response Body - size: 2,228 bytes.
Instances 48
Solution
Reference https://owasp.org/wstg
Tags
CWE Id
WASC Id
Plugin Id 10104